You notice a pattern of repeated, low-severity alerts targeting a critical application over several days, none of which individually meet your escalation thresholds. How would you approach this scenario strategically in the SOC—what steps would you take to validate if this is a coordinated campaign, and how would you engage other teams?

Question

VirtualInterview.AI · Accepted Answer

If I saw repeated low‑severity alerts against a crown‑jewel app, my first step would be to zoom out. I’d pull 7–14 days of data in the SIEM and cluster by source IP, ASN, and techniques. I’m looking for patterns: same /24 subnet, same user agents, similar paths, or gradual increase in noise. I’d enrich a sample of IPs with threat intel to see if they tie to known campaigns, then pivot into web server and WAF logs to correlate timestamps and request patterns. If I see coordination—say, 30–40% of traffic linked to the same infrastructure or clear recon patterns—I’d raise a “campaign under observation” ticket, brief the on‑call lead, and loop in the app owner and network team. Tactically, I’d propose temporary WAF rules, stricter rate limiting, and, if needed, a short‑term logging uplift. I’d document indicators in a playbook so future similar patterns auto‑group and escalate earlier.

Sample Answer

Keywords